
At the Institute for Cyber Security, we use many different technologies to help accomplish our goals at ICS Labs and the Incubator. One such technology is Aspect-Oriented Programming (AOP), a programming paradigm allowing the separation of cross-cutting concerns from core concerns. Although many software frameworks such as Spring allow for limited aspect-oriented development, I've always been fond of the AspectJ language as it provides a better pedagogy for aspects and how they differ from objects.
Object-oriented programming (OOP) guides developers into exploiting the expressive power of the object model and uses classes as their fundamental building blocks. Generally, classes may be too specialized for general “drop” reuse, are "tangled" (implementing many requirements of a system), or are used in many places ("scattered" in many classes), such as security or session expiration mechanisms.
Because scattering and tangling defy the OOP paradigm, they are symptoms of “crosscutting concerns”, as they cut across many modules in a program. AOP is an attempt to corral these naturally, with aspects being well-modularized crosscutting concerns. Gregor Kiczales and his team at Xerox PARC originated the concept of AOP and its most popular general purpose language, AspectJ. AspectJ is the most well-known and is a superset of Java (i.e., all AspectJ programs compile to Java bytecode).
In AOP, points in the code where we would want to run our code (instead of writing it in the class itself) are called "join points". A join point can be almost any line of code—a method or constructor call, a field get or set, object initialization, or exception handler execution. AspectJ intercepts program execution flow at these join points and runs the code we want to run instead, called advice, which can happen before, after, or instead of the join point. An aspect describes these join points as pointcuts, which can describe one or more join points.
An example Java program using a simple logging mechanism is shown below. In MainClass.java, two methods are being called, and with code from Logger.java being executed when each method (save the main method) is entered and left.

In the AspectJ program below, any reference to logging in MainClass.java is removed. In place of the Logger class, the Logger aspect encapsulates the logging concern. It has one pointcut called SayAnything that describes all join points that are methods being called (using the call keyword) that starts with “say” and has any number of parameters. Two advice are associated with the pointcut. The before advice gets the signature of the join point it is in, and prints “Entering” with the signature’s name. The after advice does the same, printing “Leaving” with the signature's name instead. Thus, whenever any of these join point is reached in the execution of the program, it calls the code in the before advice, executes as normal until the end of the join point, and calls the after advice.

At compile time, the compiler "weaves" the code from an aspect’s advice into the join points their pointcuts describe, leaving .class files that any Java runtime may execute. Because aspects are a superset of classes, they can contain members and methods, and can even extend other aspects or classes, although classes cannot extend aspects. Also, aspects can be quite powerful, able to read and process code with around advice, affecting the execution of the program at runtime in dynamic and very interesting ways. By the same token, AOP and AspectJ's power lend itself to augment code outside its boundaries, possibly leading to software contract-breaking. Like in any paradigm, a little knowledge is a dangerous thing (but a little more knowledge can do wonders).
For more on AOP and AspectJ, the seminal paper on AOP is a great start. There is also a classic series of tutorials on AOP by Ramnivas Laddad online.
Picture at the top shows the difference between core and corss-cutting concerns, pulled from an older version of Apache Tomcat. Red shows the relevant lines of code. The XML parsing capability of the
project is well-modularized in one file, whereas the project's logger
is used in a large number of places.
Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu